One of the most glaring flaws of the conspiracy theorists is that they assume authority are bad for bad sake, like they're some mindless evil that does bad thing for .. no apparent reason. Even though the priorities of authority might not be aligned with that of the people, it is still a set of rational priorities, for personal gain etc. Too many conspiracy theorist make no sense because the act they suspect authority do does not make any sense for anybody.

This is why you see so many satanic cult/ritual references I. Conspiracy theories. It helps explain evil for the sake of evil.

It is perfectly rational to distrust decision makers, it makes no difference whether the intent is malicious or it is just incompetence. The end result is the same.

I trust them to be malicious enough to hide their incompetence.

I am working with some, not in a high risk domain at all and I worry the same kind of people work in high risk domains (sometimes they work in both, next election they might move to another minister).

Didn’t all of these agencies come about after some incident happened that was disastrous?

The SEC came about after/during the Great Depression. Building codes stiffened after terrible hurricanes.

Sure, but what’s your point? Decisions _should_ be based on past information. You don’t expect politicians to be clairvoyant do you?

There’s no doubt that politics, especially US politics and government, are pretty screwed up, but it doesn’t automatically follow that anarchy is better.

Some of it works and some of it doesn’t. That’s the point I’m trying to make.

I think you have a point because this fear also creates incentives for scammers to profit from it.

There is a difference in how people "act" on the collective level (administrative bodies and bureaucracies, even companies) and how we respond on the individual level (employees, bread-winners, family members).

There is no serious / open conversation about this inside companies right now - some places I know even discourage you and slap you with the fear-monger label, while hoping it will just blow over. Especially in Tech where we could just send people home right away and work remotely hardly anyone does this (if it hasn't already been policy).

> Decisions _should_ be based on past information.

Making decisions only on past information is what makes Black Swans a scary reality. Maybe good time for us all to re-read Taleb https://en.wikipedia.org/wiki/The_Black_Swan:_The_Impact_of_...

I feel like there must be some sort of internet law that says, “gross incompetence is indistinguishable from malice.”

Pretty sure you are kidding, but for the benefit of future readers:

> Never attribute to malice that which can be adequately explained by stupidity.

https://en.wikipedia.org/wiki/Hanlon%27s_razor

There’s an obvious corollary:

> If you want to get away with it, make it indistinguishable from incompetence.

Here’s a WWII field manual from “them” on the subject. It actually helped me unlearn some bad behaviors instilled by previous bad management. :-)

http://www.simplesabotage.com/

Related term of art for programmers is underhanded code. Always make your undermining of security and insertion of backdoors to appear to be a simple coding error: http://underhanded-c.org/

But would you say, in a general sense, that it is better to assume malice rather than mistakes/incompetence/stupidity?

If one is responsible for ensuring security, they won't be very effective unless they realize malicious actors masquerading as the incompetent exist and are active.

If I am working on security critical software I don't try to determine the intent of anyone at all, everyone is assumed malicious and their code/actions reviewed as such.

My question was in a more general sense, do you assume that all mistakes are done on purpose to conceal some sort of plot?

> everyone is assumed malicious and their code/actions reviewed as such.

Yes we are in agreement.

> in a more general sense, do you assume that all mistakes are done on purpose to conceal some sort of plot?

Obviously not and no one is claiming that. The extremes of never assuming malice and never assuming incompetence are ... extremes.

Always starting with a presumption of innocence is said to be a useful premise for a criminal justice system. And always starting with a presumption of malice is a useful premise for security oversight. Not just code but other things like Secret Service details and plane boarding. It's assumed that boxcutter is for hijacking, so you have to give it up. It's presumed that bottle of water is some sort of chemical to be used in making a bomb, so you have to give it up. It's presumed that baby is a secret bomb, so the baby is going to be scanned and inspected. An unrecognized wellwisher rapidly approaching the President on stage at an event is presumed to be an assassin and will be tackled. A car of lost people looking for a wedding location which is approaching a US security checkpoint in Iraq or Afghanistan without slowing down will be machine gunned. A suspicious man, under the influence, who is staggering along down the center of the road in Baltimore who does not follow orders to stop and get on the ground and who instead reaches into his pocket for his id, cell phone, or breath mints, will be shot dead. Malice is the default assumption in a wide variety of security contexts.

It really needs an "... or corruption" appended to the end. ;)

"Never attribute to malice that which can be adequately explained by a coordination problem"

I find it hard to think of cases of corruption that are not rooted in malice.

Was not kidding and thank you :)

I just assumed because what you wrote fit so well with Hanlon's razor :)